from pathlib import Path
from tempfile import TemporaryDirectory
from unittest.mock import patch

from scripts.repair_gitea_creation_scopes import credential_ready, write_mounted


def test_write_credential_requires_creation_scope_not_just_read_access():
    with patch(
        "scripts.repair_gitea_creation_scopes.probe",
        side_effect=[
            (200, {"login": "Jens"}),
            (200, []),
            (403, {}),
        ],
    ):
        assert not credential_ready("fake-test-token", True)


def test_write_scope_probe_uses_invalid_name_without_creating_repository():
    with patch(
        "scripts.repair_gitea_creation_scopes.probe",
        side_effect=[
            (200, {"login": "Jens"}),
            (200, []),
            (422, {}),
        ],
    ) as probe:
        assert credential_ready("fake-test-token", True)
        assert probe.call_args.args == ("fake-test-token", "/user/repos", {"name": ""})


def test_read_credential_never_attempts_write():
    with patch(
        "scripts.repair_gitea_creation_scopes.probe",
        side_effect=[
            (200, {"login": "Jens"}),
            (200, []),
        ],
    ) as probe:
        assert credential_ready("fake-test-token", False)
        assert probe.call_count == 2


def test_wrong_identity_is_rejected():
    with patch(
        "scripts.repair_gitea_creation_scopes.probe", return_value=(200, {"login": "other"})
    ):
        assert not credential_ready("fake-test-token", True)


def test_mounted_secret_keeps_inode_and_truncates_previous_value():
    with TemporaryDirectory() as directory:
        path = Path(directory) / "credential"
        path.write_bytes(b"long-fake-old-credential")
        inode = path.stat().st_ino
        write_mounted(path, b"fake-new")
        assert path.read_bytes() == b"fake-new"
        assert path.stat().st_ino == inode